SubMaker v1.4.4-beta

This update adds a lot of changes and new features to the addon.

A few of them (sub-toolbox tools) are currently DISABLED.

All updates from v1.4.3 and v1.4.4 are summarized bellow (complete version: CHANGELOG.md)

New Features:

• Sub Toolbox hub with a single Stremio button (SRT translations, embedded subs extraction, translate, sync) plus full embedded-subtitle flow; Chrome extension protocol streams tracks out of HLS/MP4/MKV into an xEmbed cache keyed to stable video hashes (with legacy fallback).
• File translation queue supports multi-upload with batch size/concurrency controls and per-file progress/downloads.
• Stream activity feed (/api/stream-activity, SSE + polling) keeps toolbox/file-upload/sync pages in sync with what you're watching and powers a “jump to latest stream” quick-nav.
• Unofficial keyless Google Translate provider (public web endpoint) works as main or fallback, prompt-compatible, safe token estimation, optional key allowed in config/manifest.

Translation & Providers:

• Per-job override safety for provider/workflow/source language/single-batch/AI-timestamps; chunked and single-batch flows reuse cached work via stable hash keys and source-language carryover.
• Translation engine falls back to safe token estimates when providers lack counters; optional-key providers no longer block saves/validation.

Subtitles, Sync & Embedded:

• xEmbed translations are cached and exposed directly in Stremio as “xEmbed (Language)” downloads; first streaming partials wait for minimum entries to avoid tiny subs.
• xSync lookups dedupe on stable hashes with legacy fallback so old cached subs stay reachable and duplicate buttons disappear.
• Embedded routes from 1.4.3 stay (save/translate/download original or translated tracks) with VTT→SRT handling and force-retranslate support.

UI & Configuration:

• Sticky quick-nav (mobile drawer) shared across toolbox/file-upload/sync pages; embedded page shows track grid, language multi-select, provider/model selectors, real-time logs, and download cards.
• Google Translate card added; localhost/base64 configs normalized/padded, invalid tokens purged; session updates accept both session tokens and base64 tokens, many config page changes.

Storage, Cache & Infrastructure:

• Router cache + in-flight dedupe reduce duplicate work; translation caches (permanent/partial/bypass) are config-scoped with legacy promotion and user-scoped purge.
• Embedded cache offers pattern listing/stats with size-capped Redis/FS backends; brief decrypted-config caching cuts repeated decrypt/log churn; session caps tuned (30k in-memory, 60k persisted) with autosave override support.

Security & Safety:

• Strict host validation (IPv6/bracketed hosts, zone IDs) with origin/user-agent allowlists, sanitized base64 tokens, token redaction in logs, and no-store headers on stream-activity.
• Prior critical fixes retained: XSS hardening for toolbox/sync pages, NoSQL key sanitization, path traversal guardrails, and host-header poisoning prevention.

Environment Variables:

• File upload batching: FILE_UPLOAD_MAX_BATCH_FILES, FILE_UPLOAD_MAX_CONCURRENCY; host/user-agent allowlists: ALLOWED_ORIGINS, STREMIO_USER_AGENT_HINTS; embedded cache limit: CACHE_LIMIT_EMBEDDED.